CVE-2026-105846

The Payload headless content management system is vulnerable to an Open Redirect (CWE-601) in versions 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27 . An attacker can craft a malicious redirect URL parameter that sends a guest user to an untrusted destination immediately followi...

EUVD-2026-93488

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This...

CVE-2025-59824 Omni Wireguard SideroLink potential escape

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer P2P SideroLink connection using WireGuard to mutually authenticate and authorize access. The...